Risk management is a decision record, not a prediction system
The value is not in forecasting what will happen. It is in being able to show, afterwards, that the decision was reasonable on what was known at the time.
Risk management is widely understood as an attempt to anticipate what might go wrong and prevent it. That framing sets an impossible standard, because the events that actually cause serious damage are frequently ones that were not on any register, and a discipline judged on whether it predicted them will be judged a failure after every significant incident. It also produces the familiar cynicism about registers: if the last three crises were not in it, what is it for.
A more defensible account is that the discipline produces a record of deliberate decisions under uncertainty. It establishes that somebody identified a hazard, assessed it with the information available, decided what to do, and that the decision was made by a person with the authority to make it. That record is worth having whether or not the event occurs, because the alternative is an organisation where consequential exposures are accepted implicitly, by nobody in particular, without anybody having considered them.
Continue reading